BloodBank v1.0 Integration Management Access Vulnerability

BloodBank is a responsive blood bank and donor content management system CMS. A security vulnerability exists in BloodBank v1.0. An attacker could exploit the vulnerability to gain access to the device without an account or password...

CVE-2018-5242

Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2018-5242

Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access...

Sql injection

Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2018-5242

Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2018-5242

Affected product: Norton App Lock. Version pre-1.3.0.329 is vulnerable to a bypass that can allow a user to bypass the app and prevent locking, potentially gaining device access. Remediation: update to version 1.3.0.329 or later. This summary reflects details available in connected sources; no fu...

Express-cart Arbitrary File Upload Vulnerability

express-cart is a shopping cart module for use in Node.js. An arbitrary file upload vulnerability exists in express-cart versions prior to 1.1.7. An attacker can exploit this vulnerability to gain access on a hosted device...

CVE-2018-12048

CVE-2018-12048 concerns Canon LBP7110Cw: a remote attacker can bypass Management Mode on the web interface without a PIN by abusing /checkLogin.cgi in conjunction with /portal_top.html to gain full device access. Affected product: Canon LBP7110Cw web UI; vulnerability described as an authenticati...

Canon MF210 and MF220 Override Access Vulnerability

The Canon MF210 and MF220 are both printer devices from Canon Japan. A security vulnerability exists in the web interface of the Canon MF210 and MF220. A remote attacker can use this vulnerability to bypass System Manager Mode and gain full access to the device without knowing the login page PIN...

How to configure USB Passthrough with XenServer

This article describes the method to configure USB Pass-through with XenServer...

Authentication flaw

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2017-15534

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2017-15534

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2018-5455

The CVE-2018-5455 vulnerability affects Moxa OnCell G3100-HSPA Series (version 1.4 Build 16062919 and earlier). It stems from reliance on cookies without validation or integrity checking, allowing a cookie parameter consisting only of digits to be brute-forced, bypassing authentication and enabli...

The vulnerability of Microprogrammed Software for Korenix switches, related to the use of pre-installed account data, allows a perpetrator to gain access to the device.

The vulnerability of Microprogrammed Software for Korenix switches relates to the use of pre-set credentials. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

Default credentials

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials...

Receiver Warning: "A Potentially UNSAFE Connection to the Computer Has Been Initiated"

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. -Getting warning message:"A potentially UNSAFE connection to the computer has been initiated" when...

CVE-2017-12085

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability...

kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism

The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte and bypass slab-allocation access restrictions via an application that opens the...

Bypassing VirtualBox Process Hardening on Windows

Posted by James Forshaw, Project Zero Processes on Windows are securable objects, which prevents one user logged into a Windows machine from compromising another user’s processes. This is a pretty important security feature, at least from the perspective of a non-administrator user. The security...